mrwho/Ansible-Roles
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix

Browse source
This commit is contained in:
a.kazantsev 2026-07-11 01:56:08 +03:00
parent 25664a61d4
commit 9bfaa8489a
3 changed files with 32 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
playbooks/mrwho/vm03-firewall.yml
View file

@ -96,12 +96,11 @@
# zone: external # zone: external
# state: enabled # state: enabled
# permanent: true # permanent: true
- policy: - policy: lan-to-wan
name: lan-to-wan state: enabled
state: enabled permanent: true
permanent: true masquerade: true
masquerade: true ingress_zones:
ingress_zones: - internal
- internal egress_zones:
egress_zones: - public
- public

32
roles/firewall/library/firewall_lib.py
View file

@ -272,7 +272,14 @@ options:
type: str type: str
choices: ["replaced", "kept"] choices: ["replaced", "kept"]
default: "kept" default: "kept"
{"text": " includes:\n description:\n Services to include in this one.\n required: false\n type: list\n elements: str\n default: []\n policy:\n description:\n The policy name string.\n If the policy name is not given, then the default policy will be used.\n required: false\n type: str\n ingress_zone:\n description:\n List of ingress zone names.\n Traffic originating from these zones will be subject to this policy.\n required: false\n type: list\n elements: str\n default: []\n egress_zone:\n description:\n List of egress zone names.\n Traffic destined to these zones will be subject to this policy.\n required: false\n type: list\n elements: str\n default: []\n online:"} includes:
description:
Services to include in this one.
required: false
type: list
elements: str
default: []
online:
description: description:
When true, use the D-Bus API to query the status from the running system. When true, use the D-Bus API to query the status from the running system.
Otherwise, use firewall-offline-cmd(1). Offline mode is Otherwise, use firewall-offline-cmd(1). Offline mode is
@ -571,7 +578,7 @@ EXAMPLES = """
""" """
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.firewall_lsr.get_config import ( from ansible_collections.fedora.linux_system_roles.plugins.module_utils.firewall_lsr.get_config import (
config_to_dict, config_to_dict,
export_config_dict, export_config_dict,
recursive_show_diffs, recursive_show_diffs,
@ -1941,6 +1948,8 @@ class InMemoryBackend:
zone_config["masquerade"] = masquerade zone_config["masquerade"] = masquerade
self.changed = True self.changed = True
# note: rich_rule is a single string, normalized using str(Rich_Rule(rule_str=original_string))
# the zone config field 'rich_rule' is a list of normalized strings
def set_rich_rule(self, rich_rule): def set_rich_rule(self, rich_rule):
"""Configure rich rules in a zone.""" """Configure rich rules in a zone."""
for config_type, zone_config in ( for config_type, zone_config in (
@ -1950,12 +1959,12 @@ class InMemoryBackend:
if config_type and zone_config is not None: if config_type and zone_config is not None:
for item in rich_rule: for item in rich_rule:
if self.state == "enabled": if self.state == "enabled":
if item not in zone_config.get("rich_rules", []): if item not in zone_config.get("rich_rule", []):
zone_config.setdefault("rich_rules", []).append(item) zone_config.setdefault("rich_rule", []).append(item)
self.changed = True self.changed = True
elif self.state == "disabled": elif self.state == "disabled":
if item in zone_config.get("rich_rules", []): if item in zone_config.get("rich_rule", []):
zone_config["rich_rules"].remove(item) zone_config["rich_rule"].remove(item)
self.changed = True self.changed = True
def set_source(self, source): def set_source(self, source):
@ -2474,7 +2483,7 @@ class OfflineCLIBackend:
enable = self.check_state(["enabled", "disabled"], "rich_rule") enable = self.check_state(["enabled", "disabled"], "rich_rule")
for item in rich_rule: for item in rich_rule:
# note: item is a Rich_Rule object, but its __str__() does the right thing # note: item is a string, normalized using str(Rich_Rule(rule_str=original_string))
cur = self.query("--zone", self.zone, "--query-rich-rule=" + item) cur = self.query("--zone", self.zone, "--query-rich-rule=" + item)
if cur != enable: if cur != enable:
@ -2592,8 +2601,13 @@ def get_interface_pci():
device_udi = nm_get_client().get_device_by_iface(interface).get_udi() device_udi = nm_get_client().get_device_by_iface(interface).get_udi()
device_path = os.path.join(device_udi, "device") device_path = os.path.join(device_udi, "device")
for field in ["vendor", "device"]: for field in ["vendor", "device"]:
with open(os.path.join(device_path, field)) as _file: try:
interface_ids.append(_file.readline().strip(" \n")[2:]) with open(os.path.join(device_path, field)) as _file:
interface_ids.append(_file.readline().strip(" \n")[2:])
except IOError:
continue
if len(interface_ids) != 2:
continue
interface_ids = ":".join(interface_ids) interface_ids = ":".join(interface_ids)
if interface_ids not in pci_dict: if interface_ids not in pci_dict:
pci_dict[interface_ids] = [interface] pci_dict[interface_ids] = [interface]

2
roles/firewall/library/firewall_lib_facts.py
View file

@ -88,7 +88,7 @@ firewall_config:
""" """
from ansible.module_utils.basic import AnsibleModule from ansible.module_utils.basic import AnsibleModule
from ansible.module_utils.firewall_lsr.get_config import config_to_dict, HAS_FIREWALLD from ansible_collections.fedora.linux_system_roles.plugins.module_utils.firewall_lsr.get_config import config_to_dict, HAS_FIREWALLD
def main(): def main():